change schema final

docs/example.nix

@@ -1,49 +1,76 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
-  owner = {
+  metadata = {
-    username = "satr14washere";
+    description = "Example domain configuration for dns.nix"; # optional, description of use
+    proxy = false; # optional, defaults to false. proxy through Cloudflare
+    owner = { # add extra contacts if needed
+      username = "satr14washere"; # required, github username
       email = "admin@satr14.my.id";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; { # full list of records supported: https://github.com/nix-community/dns.nix/tree/master/dns/types/records
+    # dns.lib.combinators is optional but provides a lot of useful shortcuts:
+    # https://github.com/nix-community/dns.nix/blob/master/dns/combinators.nix
+    
     A = [
-      {
+      "203.0.113.50"
-        address = "203.0.113.1";
+      "198.51.100.50"
-        ttl = 60 * 60;
+      
-      }
+      # or:
-      "203.0.113.2"
+      
-      (ttl (60 * 60) (a "203.0.113.3"))
+      { address = "203.0.113.50"; ttl = 60 * 60; } # TTL is optional
+      { address = "198.51.100.50"; ttl = 60 * 60; }
+      
+      # using dns.lib.combinators:
+      
+      (ttl (60 * 60) (a "203.0.113.50")) # standalone A record
+      (ttl (60 * 60) (a "2198.51.100.50")) # record with TTL
     ];
-    AAAA = [
+    
-      "4321:0:1:2:3:4:567:89ab"
+    AAAA = [ # mostly same as above
+      "2001:db8::1"
+      "2001:db8::2"
+      
+      # or:
+      
+      { address = "2001:db8::1"; ttl = 60 * 60; }
+      { address = "2001:db8::2"; ttl = 60 * 60; }
+      
+      # using dns.lib.combinators:
+      
+      (ttl (60 * 60) (aaaa "2001:db8::1"))
+      (ttl (60 * 60) (aaaa "2001:db8::2"))
     ];
-    MX = mx.google;
+    
     TXT = [
-      (
+      "v=spf1 include:mailgun.org ~all"
-        with spf;
+      "dh=some-long-random-string"
-        strict [
-          "a:mail.example.com"
-          google
-        ]
-      )
     ];
-    CNAME = [ "example.com." ];
+    
-    DMARC = [ (dmarc.postmarkapp "mailto:re+abcdefghijk@dmarc.postmarkapp.com") ];
+    MX = [
-    CAA = letsEncrypt "admin@example.com";
-    SRV = [
       {
-        service = "sip";
+        preference = 10;
-        proto = "tcp";
+        exchange = "mail.protonmail.ch.";
-        port = 5060;
-        target = "sip.example.com";
       }
-    ];
-    TLSA = [
       {
-        certUsage = "dane-ee";
+        preference = 20;
-        selector = "spki";
+        exchange = "mailsec.protonmail.ch.";
-        matchingType = "sha256";
-        certificate = "899EB4AC9285578AFDA3CCBE152EE78D8618B8F3862FEF2703E1FC7011E9B8AA";
       }
+      
+      # using dns.lib.combinators:
+      
+      (mx.mx 10 "mail.protonmail.ch.")
+      (mx.mx 20 "mailsec.protonmail.ch.")
     ];
+        
+    # a few notes about CNAME records:
+    # - value must end with a dot (.)
+    # - cannot coexist with other record types (e.g. A, AAAA, MX) for the same subdomain
+    # - can only be one despite being a list (this example defined multiple only for demonstrating valid values)
+    CNAME = [
+      "edge.redirect.pizza."
+      "username.github.io."
+      "site.pages.dev."
+    ];
+    
   };
 }

domains/_discord.colin.nix

@@ -1,9 +1,12 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    description = "Discord verification";
+    proxy = false;
     owner = {
       username = "ColinLeDev";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     TXT = [ "dh=279643a6f8677dedb1c5c63d007fc4516149679c" ];
   };
 }

domains/_discord.cutedog5695.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "CuteDog5695";
       email = "cutedog5695@gmail.com";
       repo = "https://github.com/CuteDog5695/cutedog5695.github.io";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     TXT = [ "dh=a7c19efb0f6bc38b97a33760f6c1ee84df4151b1" ];
   };
 }

domains/_discord.justdeveloper.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "JustDeveloper1";
       email = "justdeveloper@juststudio.is-a.dev";
       repo = "https://github.com/JustDeveloper1/Website";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     TXT = [ "dh=6024027bc233825451e290ac37a4b4a1f838ee70" ];
   };
 }

domains/_discord.nix

@@ -1,9 +1,11 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "satr14washere";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     TXT = [ "dh=d509fc9014e196311ed887c2e410cdefa833436e" ];
   };
 }

domains/_discord.roki.nix

@@ -1,9 +1,11 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
     owner = {
       username = "Roki100";
       discord = "289479495444987904";
     };
-  records = {
+  };
+  records = with dns.lib.combinators; {
     TXT = [ "dh=5633078cd5bfd347a896ddb0f0de017c5423aa06" ];
   };
 }

domains/batman.nix

@@ -1,9 +1,11 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = true;
     owner = {
       username = "shadowe1ite";
     };
-  proxy = true;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "shadowe1ite.github.io." ];
   };
 }

domains/c.nix

@@ -1,10 +1,12 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "orangci";
       email = "c@orangc.xyz";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/colin.nix

@@ -1,9 +1,12 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    description = "My personal portfolio hosted on my server";
+    proxy = false;
     owner = {
       username = "ColinLeDev";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "proxy.col1n.fr." ];
   };
 }

domains/cutedog5695.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "CuteDog5695";
       email = "cutedog5695@gmail.com";
       repo = "https://github.com/CuteDog5695/cutedog5695.github.io";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/elkaff.nix

@@ -1,8 +1,10 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
     owner = {
       username = "elkhaff";
     };
-  records = {
+  };
+  records = with dns.lib.combinators; {
     CNAME = [ "portofolio-pixel.pages.dev." ];
   };
 }

domains/j.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "JustDeveloper1";
       email = "support@juststudio.is-a.dev";
       repo = "https://github.com/JustStudio7/Website";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/jacob.nix

@@ -1,9 +1,11 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "jacobrdale";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "hexon404.onrender.com." ];
   };
 }

domains/jd.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "JustDeveloper1";
       email = "justdeveloper@juststudio.is-a.dev";
       repo = "https://github.com/JustDeveloper1/Website";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/job.nix

@@ -1,9 +1,11 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "FWEEaaaa1";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     A = [ "128.204.223.115" ];
   };
 }

domains/joel.nix

@@ -1,16 +1,18 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "joestr";
       email = "strasser999@gmail.com";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     A = [ "142.132.173.34" ];
     AAAA = [ "2a01:4f8:1c0c:6cc0::1" ];
     MX = [
       {
-        exchange = "achlys.infra.joestr.at.";
         preference = 10;
+        exchange = "achlys.infra.joestr.at.";
       }
     ];
   };

domains/js.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "JustDeveloper1";
       email = "support@juststudio.is-a.dev";
       repo = "https://github.com/JustStudio7/Website";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/just.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "JustDeveloper1";
       email = "justdeveloper@juststudio.is-a.dev";
       repo = "https://github.com/JustDeveloper1/Website";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/justdev.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "JustDeveloper1";
       email = "justdeveloper@juststudio.is-a.dev";
       repo = "https://github.com/JustDeveloper1/Website";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/justdeveloper.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "JustDeveloper1";
       email = "justdeveloper@juststudio.is-a.dev";
       repo = "https://github.com/JustDeveloper1/Website";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/juststudio.nix

@@ -1,11 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "JustDeveloper1";
       email = "support@juststudio.is-a.dev";
       repo = "https://github.com/JustStudio7/Website";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/katz.nix

@@ -1,9 +1,11 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "Bananalolok";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     A = [ "69.197.135.205" ];
   };
 }

domains/no-one-is.nix

@@ -1,10 +1,12 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "EducatedSuddenBucket";
       email = "me@esb.is-a.dev";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "educatedsuddenbucket-github-io.onrender.com." ];
   };
 }

domains/pxl.nix

@@ -1,9 +1,11 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "heypxl";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "heypxl.github.io." ];
   };
 }

domains/rchessauth.nix

@@ -1,9 +1,11 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "vortexprime24";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "fire.hackclub.app." ];
   };
 }

domains/roki.nix

@@ -1,10 +1,12 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "Roki100";
       discord = "289479495444987904";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "edge.redirect.pizza." ];
   };
 }

domains/satr14.nix

@@ -1,8 +1,10 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
     owner = {
       username = "satr14washere";
     };
-  records = {
+  };
+  records = with dns.lib.combinators; {
     CNAME = [ "5th-site.pages.dev." ];
   };
 }

domains/stef.nix

@@ -1,10 +1,12 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "Stef-00012";
       email = "admin@stefdp.lol";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "proxy.stefdp.lol." ];
   };
 }

domains/ukriu.nix

@@ -1,10 +1,13 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    description = "my website";
+    proxy = false;
     owner = {
       username = "ukriu";
       email = "partofmyid@ukriu.com";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "ukriu.pages.dev." ];
   };
 }

domains/you-are.nix

@@ -1,10 +1,12 @@
-{ dns, ... }: with dns.lib.combinators; {
+{ dns, ... }: {
+  metadata = {
+    proxy = false;
     owner = {
       username = "Stef-00012";
       email = "admin@stefdp.com";
     };
-  proxy = false;
+  };
-  records = {
+  records = with dns.lib.combinators; {
     CNAME = [ "proxy.stefdp.com." ];
   };
 }

scripts/migrate-nix.py

@@ -1,16 +1,29 @@
 #!/usr/bin/env python3
 """
-Migration script to convert domains/*.json to domains/*.nix
+Migrate domains/*.json to domains/*.nix
 
-Reads each JSON domain config and generates a corresponding .nix file
+Converts each JSON domain config into a .nix file matching the format
-following the format from docs/example.nix.
+from docs/example.nix:
+
+    { dns, ... }: {
+      metadata = {
+        description = "...";
+        proxy = false;
+        owner = {
+          username = "...";
+        };
+      };
+      records = with dns.lib.combinators; {
+        CNAME = [ "example.com." ];
+      };
+    }
 
 Usage:
     python3 scripts/migrate-nix.py [--dry-run] [--delete-json]
 
 Options:
-    --dry-run      Print generated .nix content to stdout without writing files
+    --dry-run      Print generated .nix to stdout without writing files
-    --delete-json  Delete the original .json files after successful conversion
+    --delete-json  Delete the .json files after successful conversion
 """
 
 import json
@@ -20,177 +33,149 @@ from pathlib import Path
 DOMAINS_DIR = Path(__file__).resolve().parent.parent / "domains"
 
 
-def json_to_nix(data: dict) -> str:
+# --- Nix string helpers ---
-    """Convert a single domain JSON config to a .nix file string."""
+
+def escape(s: str) -> str:
+    """Escape a string for use inside Nix double quotes."""
+    return s.replace("\\", "\\\\").replace('"', '\\"').replace("${", "\\${")
+
+
+def fqdn(s: str) -> str:
+    """Ensure a domain string ends with a trailing dot."""
+    return s if s.endswith(".") else s + "."
+
+
+# --- Block builders ---
+
+def build_metadata(data: dict) -> list[str]:
+    """Build the metadata = { ... }; block."""
     owner = data.get("owner", {})
     description = data.get("description")
-    record = data.get("record", {})
-    # Some files use "proxy", others use "proxied"
     proxy = data.get("proxied", data.get("proxy"))
 
-    lines = []
+    lines = ["  metadata = {"]
 
-    # Header — no let block, just the function head with `with`
-    lines.append("{ dns, ... }: with dns.lib.combinators; {")
-
-    # Owner block as a top-level attribute
-    lines.append("  owner = {")
-    if owner.get("username"):
-        lines.append(f'    username = "{escape_nix_string(owner["username"])}";')
-    if owner.get("email"):
-        lines.append(f'    email = "{escape_nix_string(owner["email"])}";')
-    if owner.get("discord"):
-        lines.append(f'    discord = "{escape_nix_string(owner["discord"])}";')
-    if owner.get("repo"):
-        lines.append(f'    repo = "{escape_nix_string(owner["repo"])}";')
-    lines.append("  };")
-
-    # Description as a top-level attribute
     if description is not None:
-        lines.append(f'  description = "{escape_nix_string(description)}";')
+        lines.append(f'    description = "{escape(description)}";')
 
-    # Proxy as a top-level attribute
     if proxy is not None:
         lines.append(f"    proxy = {'true' if proxy else 'false'};")
 
-    # Records nested under `records`
+    owner_keys = ["username", "email", "discord", "repo"]
-    record_lines = build_record_lines(record)
+    owner_fields = [(k, owner[k]) for k in owner_keys if owner.get(k)]
-    if record_lines:
+
-        lines.append("  records = {")
+    if owner_fields:
-        for rl in record_lines:
+        lines.append("    owner = {")
-            lines.append(rl)
+        for key, val in owner_fields:
+            lines.append(f'      {key} = "{escape(val)}";')
         lines.append("    };")
 
-    lines.append("}")
+    lines.append("  };")
-    lines.append("")
+    return lines
-
-    return "\n".join(lines)
 
 
-def escape_nix_string(s: str) -> str:
+def build_records(record: dict) -> list[str]:
-    """Escape special characters for a Nix double-quoted string."""
+    """Build the records = with dns.lib.combinators; { ... }; block."""
-    s = s.replace("\\", "\\\\")
+    entries = []
-    s = s.replace('"', '\\"')
-    s = s.replace("${", "\\${")
-    return s
-
-
-def build_record_lines(record: dict) -> list[str]:
-    """Build the Nix record lines from the JSON record dict.
-
-    These are indented with 4 spaces since they sit inside `records = { ... };`.
-    """
-    lines = []
 
+    # A records
     if "A" in record:
-        values = record["A"]
+        entries.extend(string_list_record("A", as_list(record["A"])))
-        if isinstance(values, list):
-            if len(values) == 1:
-                lines.append(f'    A = [ "{values[0]}" ];')
-            else:
-                lines.append("    A = [")
-                for v in values:
-                    lines.append(f'      "{v}"')
-                lines.append("    ];")
-        else:
-            lines.append(f'    A = [ "{values}" ];')
 
+    # AAAA records
     if "AAAA" in record:
-        values = record["AAAA"]
+        entries.extend(string_list_record("AAAA", as_list(record["AAAA"])))
-        if isinstance(values, list):
+
+    # CNAME (also handles ALIAS → CNAME)
+    cname = record.get("CNAME") or record.get("ALIAS")
+    if cname is not None:
+        val = cname[0] if isinstance(cname, list) else cname
+        entries.append(f'    CNAME = [ "{fqdn(val)}" ];')
+
+    # MX records
+    if "MX" in record:
+        entries.extend(build_mx(as_list(record["MX"])))
+
+    # TXT records
+    if "TXT" in record:
+        escaped = [escape(v) for v in as_list(record["TXT"])]
+        entries.extend(string_list_record("TXT", escaped))
+
+    # NS records
+    if "NS" in record:
+        fqdns = [fqdn(v) for v in as_list(record["NS"])]
+        entries.extend(string_list_record("NS", fqdns))
+
+    # SRV records
+    if "SRV" in record:
+        entries.extend(build_srv(as_list(record["SRV"])))
+
+    # CAA records
+    if "CAA" in record:
+        entries.extend(build_caa(as_list(record["CAA"])))
+
+    if not entries:
+        return ["  records = with dns.lib.combinators; {};"]
+
+    lines = ["  records = with dns.lib.combinators; {"]
+    lines.extend(entries)
+    lines.append("  };")
+    return lines
+
+
+# --- Record type formatters ---
+
+def as_list(value) -> list:
+    """Wrap a scalar in a list if it isn't one already."""
+    return value if isinstance(value, list) else [value]
+
+
+def string_list_record(rtype: str, values: list[str]) -> list[str]:
+    """Format a record type whose values are plain strings."""
     if len(values) == 1:
-                lines.append(f'    AAAA = [ "{values[0]}" ];')
+        return [f'    {rtype} = [ "{values[0]}" ];']
-            else:
+
-                lines.append("    AAAA = [")
+    lines = [f"    {rtype} = ["]
     for v in values:
         lines.append(f'      "{v}"')
     lines.append("    ];")
-        else:
+    return lines
-            lines.append(f'    AAAA = [ "{values}" ];')
 
-    if "CNAME" in record:
-        value = record["CNAME"]
-        if isinstance(value, list):
-            value = value[0]
-        lines.append(f'    CNAME = [ "{ensure_fqdn(value)}" ];')
 
-    if "ALIAS" in record:
+def build_mx(values: list) -> list[str]:
-        value = record["ALIAS"]
+    """Format MX records as attrsets with preference + exchange."""
-        if isinstance(value, list):
+    lines = ["    MX = ["]
-            value = value[0]
-        # ALIAS is typically handled as CNAME in dns.nix
-        lines.append(f'    CNAME = [ "{ensure_fqdn(value)}" ];')
-
-    if "MX" in record:
-        values = record["MX"]
-        if isinstance(values, list):
-            lines.append("    MX = [")
     for i, v in enumerate(values):
-                priority = (i + 1) * 10
+        pref = (i + 1) * 10
         lines.append("      {")
-                lines.append(f'        exchange = "{ensure_fqdn(v)}";')
+        lines.append(f"        preference = {pref};")
-                lines.append(f"        preference = {priority};")
+        lines.append(f'        exchange = "{fqdn(v)}";')
-                lines.append("      }")
-            lines.append("    ];")
-        else:
-            lines.append("    MX = [")
-            lines.append("      {")
-            lines.append(f'        exchange = "{ensure_fqdn(values)}";')
-            lines.append("        preference = 10;")
         lines.append("      }")
     lines.append("    ];")
+    return lines
 
-    if "TXT" in record:
-        values = record["TXT"]
-        if isinstance(values, list):
-            if len(values) == 1:
-                lines.append(f'    TXT = [ "{escape_nix_string(values[0])}" ];')
-            else:
-                lines.append("    TXT = [")
-                for v in values:
-                    lines.append(f'      "{escape_nix_string(v)}"')
-                lines.append("    ];")
-        else:
-            lines.append(f'    TXT = [ "{escape_nix_string(values)}" ];')
 
-    if "NS" in record:
+def build_srv(values: list[dict]) -> list[str]:
-        values = record["NS"]
+    """Format SRV records."""
-        if isinstance(values, list):
+    lines = ["    SRV = ["]
-            if len(values) == 1:
-                lines.append(f'    NS = [ "{ensure_fqdn(values[0])}" ];')
-            else:
-                lines.append("    NS = [")
-                for v in values:
-                    lines.append(f'      "{ensure_fqdn(v)}"')
-                lines.append("    ];")
-        else:
-            lines.append(f'    NS = [ "{ensure_fqdn(values)}" ];')
-
-    if "SRV" in record:
-        values = record["SRV"]
-        if isinstance(values, list):
-            lines.append("    SRV = [")
     for srv in values:
         lines.append("      {")
-                if "service" in srv:
+        for key in ("service", "proto"):
-                    lines.append(f'        service = "{srv["service"]}";')
+            if key in srv:
-                if "proto" in srv:
+                lines.append(f'        {key} = "{srv[key]}";')
-                    lines.append(f'        proto = "{srv["proto"]}";')
+        for key in ("priority", "weight", "port"):
-                if "port" in srv:
+            if key in srv:
-                    lines.append(f"        port = {srv['port']};")
+                lines.append(f"        {key} = {srv[key]};")
-                if "priority" in srv:
-                    lines.append(f"        priority = {srv['priority']};")
-                if "weight" in srv:
-                    lines.append(f"        weight = {srv['weight']};")
         if "target" in srv:
-                    lines.append(f'        target = "{ensure_fqdn(srv["target"])}";')
+            lines.append(f'        target = "{fqdn(srv["target"])}";')
         lines.append("      }")
     lines.append("    ];")
+    return lines
 
-    if "CAA" in record:
+
-        values = record["CAA"]
+def build_caa(values: list[dict]) -> list[str]:
-        if isinstance(values, list):
+    """Format CAA records."""
-            lines.append("    CAA = [")
+    lines = ["    CAA = ["]
     for caa in values:
         lines.append("      {")
         if "flags" in caa:
@@ -198,46 +183,48 @@ def build_record_lines(record: dict) -> list[str]:
         if "tag" in caa:
             lines.append(f'        tag = "{caa["tag"]}";')
         if "value" in caa:
-                    lines.append(f'        value = "{escape_nix_string(caa["value"])}";')
+            lines.append(f'        value = "{escape(caa["value"])}";')
         lines.append("      }")
     lines.append("    ];")
-
     return lines
 
 
-def ensure_fqdn(domain: str) -> str:
+# --- Top-level conversion ---
-    """Ensure a domain name ends with a dot (FQDN)."""
+
-    if not domain.endswith("."):
+def json_to_nix(data: dict) -> str:
-        return domain + "."
+    """Convert a parsed JSON domain config to a complete .nix file string."""
-    return domain
+    lines = ["{ dns, ... }: {"]
+    lines.extend(build_metadata(data))
+    lines.extend(build_records(data.get("record", {})))
+    lines.append("}")
+    lines.append("")
+    return "\n".join(lines)
 
 
-def migrate_file(json_path: Path, dry_run: bool = False, delete_json: bool = False) -> bool:
+# --- File operations ---
-    """Migrate a single JSON file to .nix. Returns True on success."""
+
+def migrate_file(path: Path, *, dry_run: bool, delete_json: bool) -> bool:
+    """Migrate a single .json file. Returns True on success."""
     try:
-        with open(json_path, "r") as f:
+        data = json.loads(path.read_text())
-            data = json.load(f)
     except json.JSONDecodeError as e:
-        print(f"  ERROR: Failed to parse {json_path.name}: {e}", file=sys.stderr)
+        print(f"  ERROR: {path.name}: {e}", file=sys.stderr)
         return False
 
-    nix_content = json_to_nix(data)
+    nix = json_to_nix(data)
-    nix_filename = json_path.stem + ".nix"
+    nix_path = path.with_suffix(".nix")
-    nix_path = json_path.parent / nix_filename
 
     if dry_run:
-        print(f"--- {nix_filename} ---")
+        print(f"--- {nix_path.name} ---")
-        print(nix_content)
+        print(nix)
         return True
 
-    with open(nix_path, "w") as f:
+    nix_path.write_text(nix)
-        f.write(nix_content)
-
     print(f"  Created {nix_path.name}")
 
     if delete_json:
-        json_path.unlink()
+        path.unlink()
-        print(f"  Deleted {json_path.name}")
+        print(f"  Deleted {path.name}")
 
     return True
 
@@ -247,31 +234,30 @@ def main():
     delete_json = "--delete-json" in sys.argv
 
     if not DOMAINS_DIR.exists():
-        print(f"Error: domains directory not found at {DOMAINS_DIR}", file=sys.stderr)
+        print(f"Error: {DOMAINS_DIR} not found", file=sys.stderr)
         sys.exit(1)
 
-    json_files = sorted(DOMAINS_DIR.glob("*.json"))
+    files = sorted(DOMAINS_DIR.glob("*.json"))
-
+    if not files:
-    if not json_files:
+        print("No .json files found in domains/")
-        print("No JSON files found in domains/")
         sys.exit(0)
 
-    print(f"Found {len(json_files)} JSON file(s) to migrate")
+    print(f"Found {len(files)} JSON file(s) to migrate")
     if dry_run:
         print("(dry run — no files will be written)\n")
 
     success = 0
     failed = 0
 
-    for json_path in json_files:
+    for f in files:
-        print(f"Migrating {json_path.name}...")
+        print(f"Migrating {f.name}...")
-        if migrate_file(json_path, dry_run=dry_run, delete_json=delete_json):
+        if migrate_file(f, dry_run=dry_run, delete_json=delete_json):
             success += 1
         else:
             failed += 1
 
     print(f"\nDone: {success} succeeded, {failed} failed")
-    if failed > 0:
+    if failed:
         sys.exit(1)